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Broadcasting information anonymously becomes more difficult as surveillance technology im¬ 
proves, but remarkably, quantum protocols exist that enable provably traceless broadcasting. The 
difficulty is making scalable entangled resource states that are robust to errors. We propose an 
anonymous broadcasting protocol that uses a continuous-variable toric-code state, which can be 
produced using current technology. High squeezing enables large transmission bandwidth and strong 
anonymity, and the topological nature of the state enables local error correction. 


Introduction .—Almost every aspect of modern society 
relies on information processing. As digital surveillance 
capabilities continue to expand [1], so does demand for 
guaranteed-anonymous communication strategies. An 
example of such protocols is anonymous broadcasting, an 
important primitive for privacy-preserving routines [2]. 
Repeated use of such schemes could enable, for example, 
tipping off the police anonymously, secret balloting, and 
secure electronic auctions [3]. In the original classical 
formulation [4], and its improvements [5, 6], n parties 
establish shared keys enabling one party to reveal one 
bit of information while keeping her identity secret. The 
first quantum protocol that allows one to communicate 
classical information anonymously was proposed in [7]. 
A more efficient and secure quantum protocol for anony¬ 
mous quantum and classical broadcasting was reported 
by Christandl and Wehner in [8]. Here, a trusted re¬ 
source distributes ahead of time an n-partite entangled 
state |GHZ) = ^(|0i • • • 0 n ) + |li • • • l n )), one qubit to 
each party. The key feature of this quantum protocol 
is that it is completely traceless —i.e., the sender’s iden¬ 
tity cannot be determined (better than guessing) even if 
all resources are made public at the end of the protocol. 
Remarkably, tracelessness cannot be achieved classically. 

Both the protocol in [8] and its later improvements [9, 
10], however, suffer from decoherence from unwanted in¬ 
teractions with the environment. Indeed, the issue of 
decoherence is rather challenging to overcome, and it has 
surprisingly been ignored in all previous works. 

A solution to this problem is to encode the resource in 
a quantum error-correcting code [11]. Such a code should 
be fast to prepare in practical settings and should be easy 
to error correct using mostly local operations by the par¬ 
ties involved. Here we present a protocol for quantum- 
assisted anonymous broadcasting using a recently de¬ 
veloped continuous-variable (CV) toric code [12]. Sur¬ 
face codes have been extensively studied for the purpose 
of providing sustained quantum memories or for fault- 
tolerant quantum computation [13], and recent experi¬ 
ments [1 ] have built small prototype qubit toric codes. 
However, the overhead in gates and qubits for such quan¬ 
tum processing is daunting [15]. Our work shows that 


much simpler tasks for communicating classical infor¬ 
mation benefit from the topological protection of such 
codes, and the CV model is an ideal candidate since it 
can be quickly prepared and distributed to the parties 
and it provides large communication bandwidth limited 
only by the squeezing level. 

We first introduce the main idea using the discrete- 
variable (DV) toric code, and then generalize the dis¬ 
cussion to its CV analogue. In fact, while such a state 
offers natural resilience against errors, it also allows for 
a larger bit rate than either the classical or the discrete 
quantum counterpart. Furthermore, it can be easily pre¬ 
pared using Gaussian resources and operations, and we 
describe experimental implementations that could be im¬ 
plemented with current technology. 

DV toric-code anonymous broadcasting. —We illustrate 
the main idea with a qubit toric code. Consider a two- 
dimensional square lattice on a torus with qubits on 
the edges. The code states are +1 eigenstates of all 
stabilizers, A v = X e and Bf = Z e , defined 
at all vertices v and all faces / of the lattice, respec¬ 
tively [16, 17]. On the torus there are four such stabilizer 
states {|GS a b) = A| i <8)X^JGSoo)}a,be{o,i} encoding two 
logical qubits [18]. The logical operators are string oper¬ 
ators: Z v . = Y[ eeV . Z e and Xp = Y\ ee p. X e, where V 3 

and Vj are loops on the lattice and dual lattice, threading 
through or around the hole in the torus (see Fig. 1). 

Here and in the following we always consider a sce¬ 
nario with n participants, of whom exactly one of them, 
Alice, wants to anonymously broadcast a public message. 
The anonymous broadcast protocol works by preparing 
the fiducial state |GSoo) = flu 771 7 + Aj)| 0- • -0) and 
distributing n wedges of the torus, one to each party 
(see Fig. 1). When Alice wants to anonymously broad¬ 
cast the message r = 1 she performs the string operation 
Xp 2 around the loop on her wedge [see Fig. 1(c)], while 
for the message r = 0 she does nothing. Next, each 
party j measures qubits in the Z basis along an arc of 
the wedge, and publicly announces the parity rn 3 of +1 
outcomes. The broadcast message is recovered from the 
sum m,- = r (mod 2). When using a graph with 
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FIG. 1: Sketch of the protocol, (a) A CV toric code is 
prepared in the ground state of the two non-local string 
inodes where the relevant loops are shown in blue, (b) Close- 
up of the lattice. Physical bosonic modes are logically as¬ 
signed to each edge, and each edge is assigned an orien¬ 
tation. Similarly, the faces are given a uniform orienta¬ 
tion. For the indicated face and edge, o(e, /) = +1 and 
/(e) = —1 with respect to path Vi and o(e) = +1 with 
respect to path Vi (see main text), (c) The state is dis¬ 
tributed to n parties, one wedge to each. A sender Alice 
performs the unitary operator exp[i \V 2 \ 12 r /(e)g e [ 

on a loop (shown in red) around her wedge, which encodes 
a message r £ R. Next, each party j measures an opera¬ 
tor Mj := \P 2 (jT 1/2 j: eer2U) o(e)p e along an arc V 2 {j) of 
the loop V 2 (shown in blue). The parties then publicly an¬ 
nounce their measurement outcomes {mj}" =1 , and the broad¬ 
cast message is computed as their (noisy) weighted sum. 
(d) Close-up of the error mitigation strategy. The blue (green) 
ancillas are coupled to modes surrounding faces (vertices) and 
are monitored for decay to prevent errors using the quantum 
Zeno effect. Couplings across boundaries between wedges are 
enabled via long range bosonic channels (dotted lines). 


\P 2 1 = 1 (i.e., just one qubit wide, a loop along V 2 ), then 
|GSoo) is just a GHZ state in the |±) basis. For such 
a torus (loop), V\ and V\ are undefined, vertex stabi¬ 
lizers reduce to pairs of adjacent Paulis (A'X) along V 2 , 
and face stabilizers do not exist. In either case (GHZ 
or full toric code), the variance of any individual party’s 
measurement is maximal, and no collusion by any proper 
subset of the non-broadcasting parties will reveal any in¬ 
formation about the identity of the broadcaster. Using a 
qudit toric code [1! ] (or qudit GHZ state) the protocol 
generalizes to give Xq=i m j = #broadcasters (mod d), 
thus allowing up to a — 1 broadcasters. Alternatively, 
by applying the string operator X£ for r £ Z^, a single 
party can anonymously broadcast log 2 d bits per round. 

The advantage of using a toric code state instead of a 
simple GHZ state appears when one considers noise (er¬ 


rors) in the protocol. Notably, since errors in the surface 
code can be diagnosed by measuring stabilizers, all such 
measurements and corrections are local to each party— 
except for those stabilizers that straddle the boundary 
between wedges [see Fig. 1(d)] -and can be corrected 
without disrupting the protocol [20, 21]. The non-local 
stabilizers could be measured with the assistance of Bell 
pairs shared between nearest-neighbor parties to enable 
non-local gates [22]. Then, the number of entangled pairs 
needed grows as the number of parties and the size of the 
wedges—which, we show below, is a small constant. 

CV toric code anonymous broadcasting. —The ideal 
CV surface code [23] is a straightforward generaliza¬ 
tion of the qudit surface code, but it represents an un¬ 
physical model because the required states are infinitely 
squeezed. The finitely squeezed CV surface code is an 
experimentally accessible, physical approximation of this 
code [L2J. This model starts with an n x m square lat¬ 
tice endowed with oriented edges {e} and faces {/}, just 
like in the qudit case [12, 19]. An independent bosonic 
mode is logically assigned to each edge of the lattice, 
with quadrature operators q e ,p e obeying [q e ,p e >] = iS e 
(having set h= 1). The CV surface-code state is de¬ 
fined as the state annihilated by the set of vertex nul- 
lifiers {a v = Y1+ { s de + is~ 1 p e )} and face nullifiers 

{bf = En °(g /) ( s Pe - *s _ 1 g e )}, where s is the lo¬ 
cal mode-wise squeezing factor, and the orientation sign 
factor o(e, /) = ±1 if edge e is oriented the same (oppo¬ 
site) as face /. Note that [d v ,d v >] = [&/, bp] = [a„,b/[ = 
[a„, 6 j] = 0; however, [a v ,a' v ,] 7 ^ 0 and [S/,] 7 ^ 0. A 

CV surface-code state |GS) satisfies o„|GS) = 6 /|GS) = 
0 Vu,/. 

On the torus, for the case with n and m even, there 
are only n— 1 independent vertex and m — 1 independent 
face nullifiers. Hence the nullifiers do not span the space 
of physical modes, and analogously to the two qubits 
encoded in the qubit toric code [13], there are two un¬ 
constrained string modes in the CV toric code. Defining 
two oriented paths 'Pi and V 2 along the non-contractable 
loops of the torus [see Fig. l(a-b)], the annihilation op¬ 
erators for the two string modes are 

fi:= S (1) 


for j = 1 , 2 , where \Pj | is the loop length and o(e) = ±1 if 
edge e is oriented in the same (opposite) direction as P 7 . 
These operators satisfy the canonical commutation rela¬ 
tions. Since each string touches an even number of modes 
of each nullifier with opposite signs due to edge orien¬ 
tations, we have by construction: [/), d v ] = [/)-, a' v \ = 
[fj,bf] = 0. Note that [fj,b^] 7 ^ 0. For the broadcast¬ 
ing protocol, we will make use of the non-local string 
momentum operator 


M := 


1 

7W\ 


°( e )P e 

e&V 2 


1 (h + fl) 

S y/2 


( 2 ) 
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In the limit s —> oo [24], M remains well defined even 
while the f :j do not. Intuitively, the CV surface-code 
state can be prepared by performing appropriate mea¬ 
surements on a CV cluster state [24], as described in 
Ref. [12] . The prepared encoded state is a displaced 
ground state of the string modes (see Section I in the 
Supplement). The displacement can be completely ac¬ 
counted for by subtracting it from the broadcast message, 
and therefore we assume /i|GS) = / 2 IGS) = 0. 

The protocol with finite squeezing. —The protocol is 
summarized in Fig. 1. The finitely squeezed CV toric- 
code state is prepared with the string modes in the 
ground state. The variance of the string momentum 
operator M is (AM) 2 = jt-, with ( M ) = 0 (see Sec¬ 
tion II in the Supplement). The code state is dis¬ 
tributed, one wedge to each party. Assume Alice wishes 
to anonymously broadcast the real number r. This 
means displacing the string momentum M 1 —> M + r 
by means that are not detectable once the measure¬ 
ments have begun [ 8 [. To this end, she performs the 
1 /2 ~ 
unitary exp[i\V 2 \ rJ2 e eV 2 f(e)q e ] along a loop V 2 of 

her wedge. Here /(e) = ±1 if the edge e has the 
same (opposite) direction as the framing of the path 
V , where the framing of a path is to the right and 
normal to its direction [see Fig. 1(b)], Then, each 
party holding wedge j measures the Hermitian opera¬ 
tor Mj := | V 2 (j)\~ 1/2 E e€ p 2 (j) °( e )Pe along an arc V 2 (j) 
of the loop V 2 with outcome rrij £ R. Note that 
V 2 = Uj=i^M/) must be a closed loop. This implies 
pre-agreement between the parties and active communi¬ 
cation during the protocol to establish a different con¬ 
nected path in case of errors at the end points. After the 
measurements, all parties publicly announce their results 
{toj}, and using (M) = 0 the transmitted message from 
Alice can then be inferred from the (noisy) weighted sum 
M = \P 2 y 1 ^ 2 )Cy=i m ji which is equivalent to 

measuring M, which (after the broadcast) has mean r 
and variance (AM) 2 = [63]. 

Anonymity and channel capacity. —Finite squeezing 
means the broadcast will not be completely anonymous. 
Anonymity is predicated on the assumed inability to 
identify the broadcaster based on the local measurement 
outcomes. The degree to which this is true depends on 
signal-to-noise ratio (SNR) of the message strength to the 
noise in the local measurement. We want this to be small 
for high anonymity. But the signal strength cannot be 
too small lest the broadcast be too weak to be detected. 

The variance of each local measure¬ 
ment (AMj) 2 = 2 J 2 + ^7 is dictated by the p-p 
correlations, which are computed in [L2] (see Section II 
in the Supplement for details). Here, w = \V 2 (j)\ is 
the width of the wedge held by each party (henceforth 
assumed equal). Remember that the global measurement 
outcome M has variance (AM) 2 = 2 [ 2 . Here we quantify 
the amount of information an eavesdropper can obtain 
about the sender’s identity A from the measurement 


record M, assuming that only one sender (Alice) will 
send a message r, chosen from a Gaussian-distributed 
random variable R with mean 0 and variance r 2 . We 
also assume, a priori, that we have no information about 
the identity of the sender. 

To quantify the loss of anonymity, we model this as 
(unintentional) classical communication of the sender’s 
identity A through a channel whose output is the mea¬ 
surement record M. Therefore, the quantity of interest 
is the mutual information 7(M;A) between M and A. 
We find explicitly the upper bound (see Section IV in 
the Supplement) 


/(M;A)< ilog 


T n ( 1 + e + ecx) — 1 
(1 + ea-§- e )(T n ( 1 + e) - 1) 


( 3 ) 


where T n (x) is the nth-order Chebyschev polynomial of 
the first kind, and the base of the logarithm determines 
the information unit (base 2 —> bits, e —> nats, 10 —> 
digits, etc.). Here we have defined 

(AM) 2 _ t 2 

6 ' (AMj) 2 - (AM) 2 ’ “ ' (AM) 2 ' 1 j 

e = yh quantifies the ratio of global noise to additional 
local noise in the resource state, with e < 1 for a good 
resource (large squeezing), and a = 2s 2 t 2 is the SNR 
of the broadcast message [64]. The remaining amount 
of uncertainty about the sender’s identity A after know¬ 
ing the measurement record M is the conditional entropy 
77 (A|M) = H(A) — 7(M; A) = logn — /(M; A). Express¬ 
ing this in bits (log base 2 ), the probability to detect the 
sender given the measurement record is then 2 ~ ff 64 |M) 
For good resource states, we can expand 7(M; A) to O(e) 
(see Section IV in the Supplement) and show that ea <C 6 
guarantees high anonymity due to Alice’s broadcast be¬ 
ing hidden by the noise of the local measurements. 

The broadcast channel is an unbiased Gaussian chan¬ 
nel that adds noise with variance to the message R. 
The mutual information I(R\M) between R and the 
output message M is therefore a simple function of the 
broadcast’s SNR a. It can be shown (see Section III in 
the Supplement) that, conditioned on a fixed signal vari¬ 
ance r 2 , a Gaussian-distributed message R maximizes 
this mutual information. Thus, the (variance-restricted) 
broadcast channel capacity as a function of the SNR is 
equal to this mutual information: 

C(a) = I(R;M) = ^ log (1 + a). (5) 

Clearly, then, there is a tradeoff between anonymity and 
channel capacity [65] (see Fig. 2). 

Error mitigation .—To be robust to decoherence, we 
need a way to mitigate errors on the CV surface code. 
We assume errors are local and occur with a uniform rate 
7 err for all modes. A local mode error takes the code out¬ 
side the nullspace of some or all of the nullifiers touching 
that mode and may include photon loss or a more general 
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FIG. 2: Contour plot of the maximum probability p the broad¬ 
caster is correctly identified during the protocol as a func¬ 
tion of the number of players n and the channel capacity C 
[Eq. (5)]. Contours corresponding to p = 0.01,0.02,0.03 are 
labeled, and subsequent contours increase by 0.01 each. The 
white region corresponds to p > 0.25. The squeezing is 20 dB 
(s = 10 (#dB)/2 ° = 10), and each player’s wedge width is w = 6 
(see Section V in the Supplement). The inset shows (i) a solid 
blue curve corresponding to a cross section of the main plot 
along the green C = 1 line and (ii) a dashed red curve cor¬ 
responding to p = 1/n. The latter corresponds to perfect 
tracelessness (no more risk than guessing randomly), which is 
only achieved in the trivial limit of no broadcast (C = 0) or, 
for any C > 0, in the asymptotic limit of infinite squeezing. 


local error. Our error-avoidance strategy is to continu¬ 
ally drive the CV surface code back into the null space of 
its local nullifiers {a v ,bf} by reservoir engineering. This 
is done by embedding ancillary modes {c„} and {d/} at 
each vertex and face of the lattice respectively and using 
interaction sequences with the system followed by an¬ 
cillary mode decay. A suitable interaction between the 
code state and the ancilla is the quadratic Hamiltonian 
Hmt = g[J2v(clav+c v at)+Y^f(d\bf+dfb f r)}. Meanwhile 
the ancillary modes are subject to local decay with this 
map on the state p\ C a = £ v + S/ where C v [p ] = 

—8{c\c v p + pc\cv) and Cf\p\ = — S(d^dfp + pd^df)[66]. 
These coherent and incoherent interactions would be left 
on for the duration of the protocol so that errors are 
inhibited from occurring by the quantum Zeno effect 
[25-27]. Monitoring the environment near the ancillary 
modes for decay, the system can be realistically pro¬ 
jected into the desired code state provided we are in 
the “good” measurement regime defined by the condi¬ 


tion [25]: g <C J -C g 2 /'leu- The left inequality requires 
that the amount of population in the decaying ancillary 
modes is very small (so that decay events are rare), while 
the right inequality guarantees that the measurement of 
decay from the ancillary modes is sufficiently strong to 
damp coherences between code and faulty states on the 
time scale they are induced due to errors. When an error 
is detected, the players can deform their paths around 
this error as long as the wedges are large enough (see 
Section V of the Supplement). 

Implementations .—This protocol may be implemented 
using recently demonstrated methods for generating 
large-scale optical CV cluster states encoded in either 
frequency modes [28, 29] or temporal modes [30, 31] (see 
Section VI of the Supplement). The GHZ-state version is 
achievable now with achieved squeezing levels (5 dB) in 
current technology [31]. Proof-of-principle experiments 
with a surface-code state are possible with ~10 dB of 
squeezing, which is state of the art but achievable [31- 
33]. Higher squeezing would enable practical large-scale 
anonymous broadcasting. 

Resource states could also be prepared in circuit-QED 
setups, either dynamically or by engineering a quadratic 
Hamiltonian between microwave cavities [34] that has the 
CV cluster state as the gapped ground state and then 
performing quadrature measurements to map it to a CV 
surface code [12]. Single-mode [35, 36] and two-mode [37- 
40] squeezing has already been demonstrated in these 
systems, and the SQUID-based controlling technology al¬ 
lows for very strong nonlinearities [41-43], enabling high 
squeezing (~13 dB) [44-47]. 

Conclusion .—We propose using large-scale continuous- 
variable topological quantum codes for the important 
practical task of anonymously broadcasting classical in¬ 
formation, and we quantify the channel capacity and 
anonymity of the protocol in terms of its physical pa¬ 
rameters. Large squeezing enables high-capacity broad¬ 
casting with strong anonymity, but there is a trade-off be¬ 
tween the two for any fixed level of squeezing. Our proto¬ 
col outperforms other anonymous broadcasting protocols 
in two crucial ways: (1) Because a topological quantum 
code serves as the resource, the scheme is robust to errors. 
(2) Because that code is a continuous-variable code, the 
technology required for large-scale resource generation is 
already available. A notable feature of our protocol us¬ 
ing continuous variables (instead of qubits) is that with 
large enough squeezing, anonymity is maintained even 
with channel capacity C > 1 bit. This would enable 
other, more complex tasks such as anonymous yes/no 
voting [6] within a group of size < C. 
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Supplemental Information 

I. INITIALIZATION OF THE ENCODED MODE 


Given the exact nullifiers for the finitely squeezed CV 
cluster state on a square lattice [48], 


Vj = 


V2 


s 1 q j 


IS I Pj ~ E qk 
kGAT(j) 


( 6 ) 


the measured modes lie on the vertices and the face cen¬ 
ters of the CV surface-code graph, while the unmeasured 
nullifiers lie on the edges [see Fig. 1(b) in the main text 
and Fig. 3 in this Supplement]. Consider an alternating 
sum of cluster-state nullifiers fjj centered on the nodes 
of a loop Vj [e.g., every other node left to right through 
the middle of Fig. 3(a): ..., 72,98,... ]. This sum is, of 
course, also a nullifier of the original CV cluster state. 
The overlapping q terms have canceled, and the sum can 
be written (up to normalization) 


VW\ 


E (-i)^ 

ektz'Pj 


fo 


VWi\ 


E &* + &«). 


(7) 


where q hr) are the position operators for the modes to 

^k 

the left (right) of the edge e*,, and they are located at 
the faces of the CV toric code (e.g., nodes 71, 73, 97,99). 
Since these modes are measured in the q basis we have 
a record of their values {q v L, (L.r}. Call the accumulated 
value 

Ql= vm\^ (H+%e) - (8) 


Then, the prepared ground state is a displaced ground 
state of the string modes: 

(/i-Qi)|GS) = (/ 2 -Q 2 )|GS) = 0. (9) 


Henceforth, we will assume Qi = Q 2 = 0 because the 
displacement can be accounted for in the protocol by 
subtracting the value Q 2 when inferring the broadcast 
message. 

If another method is used to prepare the CV toric code 
state—i.e., not beginning with the CV cluster state— 
then one would need to initialize the string modes in the 
ground state by other means. Call the CV toric-code 
state p, where the string modes could be in any mixed 
state. Then, a possible method of cooling is to subject the 
system to decay governed by the following Louivillian: 

£prep[/5] = = — E(/7 fiP fo ) ' (^0) 

3 =1 

The engineering of such dissipative maps on lattices of 
bosons was consider in Ref. [49]. The fixed point of this 
map is the CV toric code with the unconstrained modes 
in the ground state. 



FIG. 3: Toroidal CV cluster state and toroidal CV surface- 
code state [12]. (a) Portion of a CV cluster state with toroidal 
boundary conditions. Red edges have weight 1, and cyan self¬ 
loops have weight is~ 2 [ 18]. (b) Portion of a CV surface-code 
state with toroidal boundary conditions (CV toric-code state). 
Unlabeled edges all have weight is 2 . This state is generated 
by measuring p and q on the odd nodes of (a) in a diagonally 
alternating pattern. The p measurements delete the node and 
produce a criss-cross pattern in (b) where the node used to 
be. The q measurements just delete the node. (In this case, q 
was measured on nodes 71, 73, 97, 99; p was measured on the 
other visible odd-numbered nodes; and so on.) 


II. MEASUREMENT COVARIANCE MATRIX 

In order to calculate the broadcast channel capacity 
(Section III) and the sender anonymity (Section IV), we 
need the covariance matrix of the players’ messages. In 
this section we calculate this quantity before any broad¬ 
cast is sent. 


A. General formulation 

We prepare a CV toric-code state via measurements on 
a canonical CV cluster state, as described in Ref. [12]. In 
this case, the vertex nullifiers deviate slightly from those 
discussed in the main text: 

a v = (E (^ e + is ~ 1 Pe) + E^ • ( n ) 

(with some simple modifications if on a surface with 
boundary), where s = -\/5s 2 + s~ 2 , and (} means the di¬ 
amond shaped loop of next nearest neighbours to the 
vertex v. However, everything in the protocol works 
the same as with the symmetric form a v . In particu¬ 
lar \a Vl bf] = [a„,Sj] = 0, and the string symmetries of 
the ground state subspace are the same (see [ 1]). 

Figure 6 of Ref. [ 1] shows the Gaussian graph [48] for 
the CV surface code created from a canonical CV cluster 
state, which is also reproduced here in Figure 3(b). Since 
its graph Z = zU is purely imaginary, it directly encodes 
the p-p correlations [ ]: (pp T ) = ^U. 

When using this state for anonymous broadcasting, 
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7^2 is left to right along one of these horizontal lines— 
e.g., ...,72,98,... in Figure 3(b). We can write each 
player’s measurement operator Mj along a portion V' 2 {j ) 
of this path as the inner product between the vector of 
momentum operators p and a normalized indicator vec¬ 
tor ij = \P 2 (j)\~ 1/2 \j, where all entries of Xj are ±1 
or 0. Assuming the width of each wedge is w, then 

Mj = ifp = —!= Ajp . (12) 

J Ww J 


Therefore, with respect to the original resource state 
(i.e., before any displacements intended to broadcast a 
message), 


(M 0 M k ) = ej(pp )£ k 


1, 


U A k 


= -\j 

w J 

= ±tr(UX k Xj). 


(13) 


We can also consider the total measurement M = t T p = 
|7 5 2| _1 ^ 2 A T p. Assuming n players and a width-w wedge 
given to each player, 

(AM) 2 := (M 2 ) = tr(UAA T ). (14) 


To illustrate the use of these formulas, it will be helpful 
to analyze a simpler case first. 


B. Simple case: 4-mode CV GHZ state 

Consider the linear CV cluster state in Figure 4(a). By 
measuring p on all even nodes, this state becomes the CV 
GHZ state whose Gaussian graph Z [48] is shown in Fig¬ 
ure 4(b). Forming its adjacency matrix—also called Z 
without ambiguity by taking the nodes in numerical 
order—we get Z = iXJ with 

/s 2 + s~ 2 s 2 0 

TT s 2 2s 2 + s ~ 2 s 2 

0 s 2 2 s 2 + s~ 2 

\ 0 0 s 2 



(a) 

(b) 


®— 1 — ©-1 — @-4 — 0-1 — ©-1 — 1 — ©■ 


i(i 2 +W)^)-- is 2 ~^X^ - is 2 — 2 ) 


FIG. 4: (a) Linear CV cluster state and (b) CV GHZ state, 
with all edge weights labeled explicitly. Measuring p on the 
even nodes in (a) produces (b). Notice that the self-loops at 
the ends of the GHZ state have a different weight from the 
ones in the middle. 


The trace in the final form of Eq. (13) is just the Hilbert- 
Schmidt inner product (entry-wise inner product) be¬ 
tween U and \j Xj,. The relevant matrices are 


X 1 X 


T 

1 


AiA 


T 

1 


AiA 


T 

2 


1 


-1 

0 

O' 


1 

1 

0 

0 

0 


0 

0 

0 

. 0 


0 

0 

0 , 

0 

0 

0 


0 ' 

0 

0 

0 


0 

0 

0 

1 


-1 

.0 

0 

-1 


1, 

0 

0 

1 


-1' 

0 

0 

-1 


1 

0 

0 

0 


0 

.0 

0 

0 


0 , 


(19) 


( 20 ) 


( 21 ) 


Taking entry-wise inner products of these with U, we can 
see that 


(M 2 ) = (M 2 ) = t [ (s 2 + s -2 } + (2s 2 + s - 2) _ 2 s 2] 
2 1 


5 ' 

= T + 2s 2 ’ 


( 22 ) 


and 


(MiM 2 ) = (M 2 Mi) = 


—s 


(23) 


The total measurement M has A = A 1 +A 2 . Therefore, 


We postulate two players using this state for broadcast¬ 
ing: 


Ml := -^(pi ~p 3 ), 

(16) 

1 

M-2 ■■= ^(.P5 ~Pt) ■ 

(17) 


Therefore, 


AA t = 


1 

T-1 

1 

1-1 

-1 

1 

T-1 

1 

1 

T-1 

1 

1 

1 -1 

-1 

1 

T-1 

1 


(24) 


and the resultant entry-wise inner product with U is the 
sum of the diagonal of U minus all entries on the sub- 
and superdiagonals: 


Ai — 




(18) 


(AM) 2 = (M 2 ) 


^ [2(s 2 + s -2 ) + 2(2s 2 + s -2 ) 

O 

1 

2s 2 ' 


6s 2 ] 

( 25 ) 







7 


Notice that all of the large-variance terms (~ s 2 ) cancel 
in this sum. (The fact that the self-loops at the ends 
are different from those in the center of the chain is re¬ 
quired for this cancelation to happen.) Therefore, the 
total measurement has a small variance even though indi¬ 
vidual players’ measurements have a large variance—this 
is the essence of the anonymous broadcasting protocol. 


C. CV toric-code state 


We now return to the case of the toric-code state shown 
in Figure 3(b). We assume a general scenario of n players, 
each of whom possesses a slice of the torus of width w. 
Because of the toroidal boundary conditions, nw must 
be even, and we assume it is not trivially small (i.e., 
nw > 4). 

For illustration, we start with the concrete example of 
w — 4. Then, 


Xj = (0 ••• 0 1 -1 1 -1 0 0) T , (26) 


where the nodes with nonzero entries are numbered along 
V 2 . Since any node not along V 2 corresponds to a 0 in 
all of the Aj, we can consider just the induced subgraph 
of U restricted to V 2 —in other words, the submatrix of 
U restricted to the nodes along V 2 . 

Inspection reveals that along V 2 , U for the toric code 
[Figure 3(b)] is exactly like that of the GHZ state [Fig¬ 
ure 4(b)] except at the ends, where there is an extra edge 
connecting the two endpoints and self-loops of weight 
2s 2 + s~ 2 instead of s 2 + s~ 2 . Continuing with the ex¬ 
ample above (and omitting zeros), 


/ \ 


1 

t-H 

1 

-1 

1—1 

1 

i —1 

1 

1 

i —1 

1 

1 

-1 

1—1 

1 

i —1 

1 


V 7 


(27) 


with the size of the padding on each side (representing 
zeros) left unspecified but determined by j and k. 

The relevant part of U is circulant tridiagonal (nodes 
numbered according to V 2 ) with all diagonal entries 2s 2 + 
s~ 2 (no difference at the ends because of periodicity) and 
all sub- and superdiagonal entries (continued in a circu¬ 
lant fashion) equal to s 2 : 





Vs 2 



(28) 


where a = 2s 2 + s -2 , nodes are again ordered according 
to their appearance along V 2 , and H > indicates that only 
the relevant part of the full U is shown [cf. Eq. (15)]. 


When j = k, the 4x4 block of ±1 in Eq. (27) is on 
the diagonal, and thus only the three innermost diag¬ 
onals of that block matter when taking the entry-wise 
inner product with U. Therefore, for w = 4, ( M 2 ) = 
|[4(2s 2 + s -2 ) — 6s 2 ]. When j — k = ±1 (mod n), then 
the only entry that matters is the —1 in the upper right or 
bottom left of the block, and thus (MjMj±i) = |(—s 2 ). 
Analogous results hold for other even values of w, but we 
will postpone the general formula until we consider the 
odd case. 

When w is odd, the form of the number block in 
Eq. (27) differs depending on whether j — k is even or 
odd. This is because adjacent measurement operators 
have opposite sign configurations when adding up the in¬ 
dividual p operators. Using w = 3 as an example, 


/ 


\ \ T 

‘v / U7 +even 


V 


1 -1 1 

-1 1 -1 

1 -1 1 


\ 

7 


t 

\ \ T 

A ‘0 A ‘j +odd — 

V 


-1 1 -1 

1 -1 1 

-1 1 -1 


\ 

7 


(29) 


(30) 


Notice that, once again, for the same reasons as for even 
w, only the cases where j = k or j — k = ±1 (mod n ) 
matter, and now the pattern for both even and odd w is 
clear (and the same in both cases): 


(M 2 ) = -5- [w{2s 2 + s~ 2 ) - 2{w 
J zw 

1 s 2 

2s 2 w 

{M j M i±1 ) = ^., 


l)s 2 ] 


(31) 

(32) 


where the ±1 is mod n. These are the pre-broadcast 
covariances of the players’ measurement operators using 
a toric-code state. They also hold for the GHZ state with 
periodic boundary conditions, which is a special case of 
the torus. 

The total measurement M has a matrix AA T whose 
nonzero block is nw x nw and of the same form as 
Eq. (24). Notice that in order to get the periodicity to 
match up, nw must be even. Examining the form of U in 
Eq. (28) , we see that we must add the diagonal of U and 
subtract its sub- and super diagonals, including their cir¬ 
culant extensions (the entries in the corners). Therefore, 
we have the general result 


(AM) 2 = (M 2 ) 


1 

2 nw 
1 


[mu (2s 2 + 


2s 2 ’ 


s 2 ) — 2 nw(s 2 )] 

(33) 


which holds for all n and w (with nw > 4 and even). 











D. CV surface-code state with open boundaries 


The calculations of broadcast channel capacity (Sec¬ 
tion III) and sender anonymity (Section IV) assume a 
toric-code state, whose results were presented above. The 
optical implementation (Section VI), however, proposes 
implementing the protocol using surface-code states with 
open boundaries instead. Here we show that this sort of 
resource also works. 

The open-boundary surface-code state is shown in Fig¬ 
ure 5(b), where the top and bottom are ‘smooth’ bound¬ 
aries, and the left and right are ‘rough’ boundaries, cho¬ 
sen by convention because of their visual representation 
in the graph. We can choose V 2 to be any of the three 
horizontal lines of nodes in that graph that stretch all the 
way from the left boundary (rough) to the right bound¬ 
ary (also rough)—e.g., 3, 13, 23, 33. Alice will apply her 
displacements along TV, which could be, for instance, 11, 
13, 15, or any of the vertical lines parallel to that one 
and that stretch all the way from the bottom boundary 
(smooth) to the top boundary (also smooth). 

Notice that the self-loops at the rough boundaries [Fig¬ 
ure 5(b)] are like the endpoints of the CV GHZ state 
[Figure 4(b)]. In fact, by the same logic as in the toric- 
code case above, the only part of U that will matter is 
the submatrix of the full U limited to the nodes along 
V- 2 - This now has the exact same form as the U for the 
GHZ state, which is given in Eq. (15). For arbitrary n 
and w (with nw > 4 and even), this becomes 


b s 2 \ 

2 a s 




V 



(34) 


where a = 2s 2 + s ~ 2 and b = s 2 + s -2 , and i-> again 
indicates that only the relevant part of U is displayed. 
Notice the two differences between this and Eq. (28): In 
Eq. (34), the first and last diagonal entries are different 
from the rest, and the isolated corner entries are missing. 

Using the same arguments as above, we have the fol¬ 
lowing nonzero covariance terms: 

{Ml) = (Ml) = 


(Mf) = 


(MjM j±1 ) = 

where 2 < j < n — 


[(w - 1)(2 s 2 + s 2 ) 


1 

2 w 

+ (s 2 + s ~ 2 ) - 2(w - l)s 2 ] 

1 

2s 2 + 2 w ’ 

— \w(2s 2 + s~ 2 ) — 2 (w — l)s 2 l 
2 w 1 J 

1 s 2 

2s 2 w ’ 

-s 2 

2w ’ 


(35) 

(36) 

(37) 


1. Notice that the ±1 is no longer 


©-©-©-©-©-©-© 

© - 0) - © - © - © - © - © 

© -©- © - © - © - © - © 

© - © - © - © - © - © - © 


© - © - © - © - © - © - © 



FIG. 5: Open-boundary CV cluster state and CV surface- 
code state, (a) CV cluster state with open boundaries. Red 
edges have weight 1, and cyan self-loops have weight is~ 2 [48]. 
(b) CV surface-code state with smooth boundaries on the top 
and bottom and with rough boundaries on the left and right. 
Unlabeled edges all have weight is 2 . Starting from (a), the 
smooth boundaries are generated by measuring p on nodes 
6,16, 26,10, 20, 30. The rough boundaries are generated by 
measuring q on nodes 2,4,32, 34. An alternating pattern of p 
and q measurements on all remaining even nodes completes 
the transition to the surface-code state. (The terms ‘smooth’ 
and ‘rough’ are chosen by convention to visually match the 
boundaries of the resulting graph.) Also notice that the three 
horizontal lines extending the full width of (b) have the same 
weights as the CV GHZ state from Figure 4(b). 


mod n. Also, 


(AM) 2 = (M 2 ) 


—— \(nw — 2)(2s 2 + s 2 ) 

2 nw 

+ 2(s 2 + s~ 2 ) — 2 (nw — l)s 2 ] 


1 

2 © ' 


(38) 


In this case, the noise of the broadcast message is the 
same, (AM) 2 = which means the channel capacity 
is the same (Section III). But now players 1 and n are 
more at risk of being discovered if one of them is the 
broadcaster. This is because the local noise in their mea¬ 
surement outcomes is less than that of the other players, 
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and it is this local noise that hides the fact that any in¬ 
dividual player has broadcast a message (Section IV). 

One might be tempted to think that making the end 
wedges (1 and n) narrower, with a width of ^ instead 
of w, could make the local noise the same for all players. 
This is true—but misleading. The reason for this is that 
if player 1 or n wanted to broadcast a message R, her 
measurement outcome would be displaced further than 
would players 2 ,.. .,n — 1 if one of them instead had 
broadcast the same message—in fact, further by a fac¬ 
tor of v2 [see Eq. (45)]. This means that the variance 
of that displacement is twice what it would be had she 
used a full w;-width wedge. This effectively nullifies the 
advantage of increased local noise in the narrower wedge. 
Either way, the local signal-to-noise ratio (which governs 
the risk of broadcaster discovery, see Section IV) is ap¬ 
proximately twice what it would be for any of the other 
players wishing to broadcast the same message. Thus, 
there is no advantage to using narrower wedges at the 
ends. 


III. BROADCAST CHANNEL CAPACITY 

In this section, we calculate the channel capacity 
for the broadcast channel. We do not consider the 
anonymity of the broadcast (discussed in Section IV) but 
only how much information can be broadcast in one it¬ 
eration of the protocol. Since the message space is un¬ 
bounded, the capacity is technically infinite. Therefore, 
in order to get a finite quantity, we will actually calculate 
the channel capacity conditioned on a fixed variance r 2 
of the message to be broadcast. (This does not spec¬ 
ify the shape of the broadcast message distribution, of 
course, since two possibilities would be a Gaussian with 
variance r 2 and a binary distribution with d-function sup¬ 
port only at ±r.) 

For an input message RgM. and some output recon¬ 
structed message M £ R, the variance-restricted channel 
capacity is C = max pji ( r ) I(R;AI), where the maximum 
is over all input probability distributions p R (r) with vari¬ 
ance t 2 , and I(R-M) = H(M) — H(M\R ) is the mu¬ 
tual information between R and M [50] . The conditional 
probability PM|fl( m l r ) = is a normal dis¬ 

tribution in output m with mean r and variance (AM ) 2 
from Eq. (33). 

For an arbitrarily distributed R with mean p 
and variance r 2 , the cumulant vector [51] for R is 
c R = (/b t 2 , C 3 , C 4 ,...), and that for M is called c m- Us¬ 
ing the law of total probability, 

PMijn) = J dr p M \ R {m\r)p R {r) 

= (-No,(A m ) 2 *PR){m), (39) 

where * indicates convolution. Cumulants add under 


convolution [51] . Therefore, 

cm = c R + (0, (AM) 2 , 0, ... ) 

= (m^ 2 + (AM) 2 ,c 3 ,c 4 ,...) . (40) 

Note that H(M\R) is fixed by the channel since 
PM\R( m \ r ) is a function only of (m — r), and thus av¬ 
eraging over R does not change the entropy. There¬ 
fore, the only difference that p R makes to I(R;M) is 
through H(M). We can maximize J(i?;M) by maximiz¬ 
ing H(M) (subject to the r 2 constraint), which means 
requiring that Pm be Gaussian (see Section VII) with 
variance r 2 + (AM ) 2 and arbitrary mean. This can be 
achieved by requiring all cumulants beyond the second 
of cm to be zero—i.e., c m = (/b r 2 + (AM) 2 ,0,0,...). 
Therefore, c R = (p,, r 2 , 0, 0, ...), which means that the 
maximizing p R is also Gaussian. For a given variance r 2 
of the message, this choice maximizes the mutual infor¬ 
mation and thus defines the (variance-restricted) channel 
capacity (see Section VII): 

C = ^ log[27re(r 2 + (AM) 2 )] — ^ log[27re(AM) 2 ] 

= \ log (1 + a) , (41) 

where a = (am ) 2 the signal-to-noise ratio (SNR) of 
the broadcast. 


IV. SENDER ANONYMITY 

In this section we quantify the anonymity of the broad¬ 
cast channel in terms of how much information about the 
identity of the sender leaks out into the classical mea¬ 
surement record. We assume a surface-code state with 
toroidal boundary conditions, as presented in the main 
text and discussed in Section IIC, in order to simplify the 
calculation by putting all players on the same footing. A 
similar calculation is possible using other boundary con¬ 
ditions and more general assumptions, but our purpose 
is simply to quantify the amount of anonymity in a basic 
instance of the protocol. 


A. Players’ measurements covariance matrix after 
broadcast 

In Section IIC, we calculated the covariance matrix of 
the players’ individual measurement outcomes before any 
broadcast is made (which we now call Mj): 

= 2^ + w’ ^ 

(m>m 3±1 ) - =£ 


( 43 ) 
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and all other covariances are 0. As such, the full co- 
variance matrix for the random measurement-results vec¬ 
tor M can be written using the definition for the circulant 
matrix in Section VII, Eq. (87): 


which will be more straightforward to calculate. 

The conditional entropy is the entropy of M if one 
knows who the broadcaster is, averaged over both the 
message and the broadcaster’s identity: 


s : = (™ T ) = iif' c - (-? - 2 ) ■ < 44 > 

Let the identity of Alice (the broadcaster) be associ¬ 
ated with a random variable A £ {1,... ,n}. (It is ran¬ 
dom because other people wishing to discover her identity 
do not know who she is.) We assume that she wishes to 
broadcast a real number r £ R, which we shall treat as 
an instantiation of a Gaussian-distributed random vari¬ 
able R ~ N 0 T 2 (r), as is prescribed to be optimal in Sec¬ 
tion III. Conditioned on Alice actually being player a, 
applying the string-operator shift along V 2 to implement 
the broadcast, the actual random measurement outcome 
for each player can be written 

Mj |„ := Mj + iJnR6 ja , (45) 

since n = Pa l/IPaO') |- Then, the variance and covari¬ 
ance of the actual measurement outcomes when averaged 
over the actual message sent are, respectively, 

( M j\a) = ^2 + ~ + nr2 ^a - ( 46 ) 

(M i|o M j±1| 0 > = =£. (47) 

This gives the following covariance matrix of the actual 
random vector of outcomes, conditioned on the broad¬ 
caster being player a: 

S| a := = S + nr 2 e aa , (48) 

where e aa is a matrix with a 1 in the (a, a) entry and 
zeros everywhere else. 


B. Leakage of information about broadcaster’s 
identity 

We model the leakage of information about the 
broadcaster’s identity in terms of the mutual informa¬ 
tion /(M; A) between the random vector of measurement 
outcomes M (averaged over the broadcaster A and the 
message R) and the random variable A identifying the 
broadcaster [50] . In other words, how much information 
about A can be extracted from M? More specifically, 
this measures how much the entropy of A is reduced (on 
average) if one has access to the measurement record M: 

I{M-A) = H(A)-H(A\M). (49) 

Symmetry of the mutual information means that we can 
also write it as 


(50) 


H(M\A) = <- log pm|a(M|A)) m ^ . (51) 

We assume, for simplicity, that we have no initial infor¬ 
mation about the broadcaster’s identity—a flat prior over 
all possible broadcasters: 

A ~ pa(cl) = - . (52) 

n 

From the subsection above, we know the distribution of 
the message M| a conditioned on knowing who the broad¬ 
caster is: 


M| a ~ p M | A (m|a) = Ao,£ | a (m). (53) 

Therefore (see Section VII), 

i7(M|A) = 0 logdet (27re£| A )^ 

= - logdet [27re (S +?rr 2 ei i i)] . (54) 

Note that nr 2 could have just as well been added to any 

other location on the diagonal; the (1,1) entry was chosen 
by fiat. 

Using the law of total probability, we can calculate 

n 

M ~ p M (m) = ^p M |. 4 (m|a)p A (a) 

a—1 

1 " 

= - N o,s ]a ( m ) • ( 55 ) 

n “ 1 


This is not a Gaussian; rather, it is a mixture of Gaus- 
sians with different covariance matrices. Nevertheless, 
we can use the law of total expectation to calculate 


S := (MM t ) m 
1 71 



a—1 


= S + r 2 I 


(56) 


By Eq. (85) in Section VII, we can use this to place an 
upper bound on H (M): 

if (M) < i logdet [27re (S + r 2 l)] . (57) 

And hence, combining Eqs. (54) and (57), we have 


f (M; A) < ^ log 


det(S + r 2 l) 
det(S + nr 2 ei j i) 


J(M; A) = H (M) - £f(M| A ), 


(58) 
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Using e and a from Eq. (4) of the main text, repeated 
here for reference, 


e = 


{AM) 2 


a = 


(AM,-) 2 - (AM) 2 ’ (AM) 2 ’ 

we can write 


(59) 


S + r 2 I= — C„[—2(l + e + ea)], (60) 

Zw 

-s 2 

E + nr 2 ei i = ——C n [-2(1 + e), -2nea ]. (61) 

Zw 

Using Eqs. (94), and (97) in Section VII, we obtain 
an explicit bound on the amount of information about 
the broadcaster’s identity leaked within the measurement 
outcomes (assuming n > 3): 


/(M; A) < \ log | ri+ r " ( atL + r! ) H 
2 I (1 + eagj) [T n (1 + e) — 1] 


(62) 


The mathematical form of Eq. (62) can be inter¬ 
preted as comparing a shift in a function [namely, 
/(e) i-)- /(e + ea), where /(e) = T„(l + e) — 1] to its first- 
order Taylor-series approximation. When this is a good 
approximation, anonymity is high, and little identifying 
information leaks out. 

The only reason Eq. (62) is not an equality is that we 
used the fact that the entropy of a mixture of Gaussians 
is upper bounded by the entropy of a Gaussian with the 
same covariance as that of the mixture. When this is a 
bad approximation, it is possible that the right-hand side 
of Eq. (62) could exceed H{A) = logn, while the actual 
value of 7(M; A) never will. 

Also note that 7(M;A) as calculated is not additive 
under multiple repetitions of the protocol because after 
each run, the prior pa{o) about the sender’s identity will 
have changed based on the new information, requiring a 
new calculation. Nevertheless, for a single instance of the 
protocol, Eq. (62) quantifies the lack of anonymity of the 
broadcaster. 

Anonymity is high whenever Alice’s post-broadcast 
probability of discovery is very low: 


1 > = 


2/(M;A) 

2 h ( a ') 


(63) 


using log base 2. Replacing 7(M; A) in Eq. (63) with its 
upper bound from Eq. (62) and then squaring both sides 
only strengthens the condition, which lets us write the 
following in the limit of a good resource state (e <C 1): 


n 2 > 1 + 


(n 2 — l)a 2 e 

6(1 + a) 


+ 0(e 2 ). 


(64) 


Solving for a and dropping terms of 0(e 2 ) gives the 
bound reported in the main text: 

(65) 


Since ae is the SNR of the broadcast message to the 
excess noise in each of the local measurements, we can 
summarize this condition by saying that anonymity is 
high when the broadcast message is sufficiently obscured 
by the local measurement noise. 


V. WEDGE WIDTH IN FIGURE 2 

Figure 2 in the main text assumes that the players 
have received wedges of width w = 6. Here we justify 
this choice. 

We assume the ancilla-based error suppression and de¬ 
tection scheme proposed in the main text. A detected 
ancillary photon decay event indicates a error in the code 
(a jump out of the code space) in the neighborhood of 
that vertex and face. We then logically tag that location 
as a part of the code to be avoided—effectively declaring 
that node lost completely. This is a conservative choice 
that allows us to steer clear of detected errors altogether. 

For rates of lost (i.e., error-tagged) nodes below the 
toric-code error tolerance rate of 50% (error per mode 
Pen = \ per physical operation), as derived from the per¬ 
colation threshold for a square lattice [52], paths can be 
found that connect the lattice along homologically non¬ 
trivial loops. Communication between parties restricts 
the allowable density of errors and defines a lower bound 
for the width of each wedge. For occupation probability 
p below the percolation threshold p c , the probability that 
there is a cluster of radius r in the percolation model is 
given by p c iuster(^) ~ e~ r ^ p ~ Pc ^ where v is the critical 
exponent [53]. For bond percolation on a square lattice 
in two dimensions, p c = | and v = |, so the probability 


the protocol fails due to these errors is 


Pfail 


D - T Perr-2 


[ 4/3 


Hence, for a target pf a ;i, we have 

21 °g(Pfail) 


VJ > 


IPerr 


II4/3 • 

2 I 


( 66 ) 


(67) 


Assume errors can be monitored, for instance using 
the protocol described in the main text. Then, if one 
of the parties measures a percolated cluster of errors on 
her wedge, she can announce an abort warning to the 
others. The whole protocol can then be retried, and the 
probability of failure after k attempts is Say we fix 
Pfaii = 1/e, implying 


w > 


\Pe rr - 


( 68 ) 


Then, assuming an error rate p e „■ < 0.06, a wedge width 
of w = 6 will suffice. This percolation argument also 
assumes a circumference of the wedge around the same 
size. 


ae<6. 
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VI. OPTICAL IMPLEMENTATION 

Here we detail the optical implementation mentioned 
in the main text. 


A. Macrocode-based CV cluster states 

Recent experimental results have shown that compact 
optical experimental setups can produce huge CV clus¬ 
ter states, including a 10,000-mode CV cluster state [31] 
with modes multiplexed in time (temporal modes) and 
a 60-mode CV cluster state [29] with modes multiplexed 
in frequency (frequency modes). These are cluster states 
with linear graphs, but the extension to a square lattice is 
straightforward and readily achievable with current tech¬ 
nology [28, 48, 54], 

These setups were already discussed in Ref. [L2] as 
candidates for generating CV surface-code states like the 
ones necessary for this protocol. Here we review this con¬ 
struction and discuss its implementation for anonymous 
broadcasting. 

The temporal-mode [30, 31] and frequency-mode [28, 
29, 54, 55] construction methods generate a toroidal [54, 
55] or cylindrical [28, 30] CV cluster state with a Gaus¬ 
sian graph [48] whose overall structure is that of a square 
lattice but is nevertheless not an ordinary lattice like in 
Fig. 3(a). Instead, it is a lattice based on 4-node group¬ 
ings called macronodes, with a structure as shown in 
Fig. 6. The actual CV cluster state has the full graph [48] 

Z = *<5I + tG , (69) 

where <5 = sech 2 r,t = tanh 2r, and G is the graph shown 
in Fig. 6, with edge weights ±|. 

By measuring the top three modes of each macronode 
in q, all but a single layer of the grid is deleted, leav¬ 
ing a uniformly-weighted, ordinary CV cluster state with 
graph [48] 

Zcs = *61 + SAgrid , (70) 

where 6 = sech 2r, g = \ tanh 2r, 7' > 0 is an over¬ 
all squeezing parameter, and A gr id is a binary adjacency 
matrix for an ordinary square-lattice graph with bound¬ 
ary conditions (toroidal or cylindrical) inherited from its 
parent, Eq. (69). Note that the edge weights in Zcs are 
all | tanh2r, while in the canonical construction [shown 
in Fig. 3(a)] they should all be 1. Nevertheless, we can re¬ 
model the cluster state [12, 56] by redefining quadratures 
so that the edge weights are 1 but at a cost of multiplying 
the self-loop weights by g~ x . Since sech2r = S —■ s^ 2 , 
this means that the original value of sq (so labeled to 
differentiate it from the actual s used in the protocol) 
could be considered to be So = \J cosh 2r, except for the 
non-unit g. The new effective value of s, which should be 
used in the calculations in the previous sections, is less 



FIG. 6: Basic graph G for temporal-mode CV cluster 
states [30]; the full graph [48] is given in Eq. (69). G, as 
shown, also represents frequency-mode CV cluster states [28, 
54, 5f ] up to trivial 7r phase shifts that merely flip the sign of 
some of the edges. Notice that G has the overall structure of 
a square lattice [Fig. 3(a)], but the individual nodes of that 
lattice are now collections of 4 nodes called macrocodes. Each 
mac.ronode is identified by its surrounding red oval. In the 
temporal-mode case [30], each of the 4 nodes within a macron¬ 
ode is a synchronous temporal mode in four spatially separate 
laser beams. In the cylindrical frequency-mode case [28], each 
of the 4 nodes within a macronode share a common frequency 
but differ in spatial beam and polarization. The toroidal 
frequency-mode case [54, 55] is more complicated in struc¬ 
ture and offers no advantages over the cylindrical one, so we 
do not consider it further. 

than half this initial value [12, 56]: 

s = tanh 2r = - V sinh 2r , (71) 

With a canonical CV cluster state obtained, which has 
uniform edge weight of 1, with s from Eq. (71), we 
can use local q measurements to “cut and unroll” the 
cylinder or torus into a square lattice with the neces¬ 
sary smooth/rough boundary conditions as identified in 
Section IID. Further local q and p measurements are 
then used to convert this state to a CV surface code 
state [12] with two rough and two smooth edges as shown 
in Fig. 5(b), which is then distributed to the players. The 
broadcast protocol proceeds according to the modifica¬ 
tions described in Section IID. 

One might think we could take advantage of the cylin¬ 
drical or toroidal structure of the original CV cluster 
states to produce a surface-code state with periodic 
boundaries. This fails, however, because the graphs of 
both states have a one-grid-unit twist along each com- 
pactified direction [28, 30, 55], which makes the checker¬ 
board pattern of measurements needed to convert it into 
a cylindrical or toroidal surface code fail to line up prop¬ 
erly. This is why we have to cut it into a surface code 
with open boundaries instead. If the twist were by an 
even number of grid units, other boundary conditions 
might be possible. 

The temporal-mode scheme [30] claims an advantage 
over the cylindrical frequency-mode scheme [28] in terms 
of ease of distribution. This is because the temporal- 
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mode cylindrical lattice is built up like sequentially wind¬ 
ing thread around a spool. This means that large chunks 
of the lattice are contiguous in time. Thus, one only 
needs a quickly adjustable mirror in order to distribute 
the pieces of the lattice to the players. Initially, the mir¬ 
ror is used to direct one of the four output beams to 
the first player. (The other three beams are immediately 
measured in q to do the projection down to an ordinary 
lattice.) Once the player has received enough modes to 
form his/her sublattice, the mirror is switched so that the 
output beam is directed toward the second player, and 
so on. q measurements at the start and end of this entire 
process are used to clean up the total lattice before the 
players themselves do the necessary additional q and p 
measurements to transform the state into a surface-code 
state. The “radius of the cylinder” in the temporal-mode 
case is limited by the coherence length L of the laser, but 
its width in the temporal direction—which is the direc¬ 
tion used to measure the width w of each player’s wedge, 
for instance—is not so limited since far-separated modes 
do not need to directly interact. This means that the 
temporal-mode scheme is capable of involving a practi¬ 
cally unlimited number of players. 

The cylindrical frequency-mode scheme [28] has the 
same graph structure, but the frequencies of nearby 
modes are widely separated, so it is not as easy to 
split the lattice up into contiguous pieces for distribu¬ 
tion. If this hurdle could be overcome, the frequency¬ 
mode scheme might claim an advantage because it is 
a continuous-wave scheme, meaning it might provide a 
means to transmit information continuously, rather than 
in bursts, as would be required by the temporal-mode 
scheme. 


B. Squeezing levels for surface-code protocol 

The rescaling of s shown in Eq. (71) means that this is 
likely not the most efficient way of generating a surface- 
code state, in terms of making good use of available 
squeezing resources [56]. Further theoretical work could 
lead to better procedures, but for now, we can look at 
the state of the art and what is achievable. 

The largest squeezing achieved to date in these large- 
scale schemes is 5 dB in the temporal-mode experi¬ 
ment [31]. This corresponds to 

r = ^F lnl ° ~ °- 5756 ’ (72) 

which means that the effective s for a protocol using this 
state is 

s = ^ V sinh 2r ~ 0.5965, (73) 

which corresponds to an effective initial squeezing of 

(effective #dB) = 20 log 10 s ~ —4.488 dB (74) 


when doing the protocol. The negative sign means 
that this state is equivalent to a canonical CV cluster 
state [Fig. 3(a)] made with anti-squeezed vacuum modes 
(i.e., vacuum modes squeezed in the wrong direction) [48]. 
Note that this does not mean that we would be better off 
not doing any squeezing at all in the actual experiment. 
Instead, this is simply a side-effect of the straightfor¬ 
ward, but squeezing-inefficient [12, 56], projection to an 
ordinary lattice from the macrocode-based lattice shown 
in Fig. 6. In this case, it produces a poor-quality state 
that is equivalent to one made with anti-squeezed input 
modes. Since we want s 2 1 for nontrivial channel ca¬ 
pacity with high anonymity (Sections III and IV), either 
improved squeezing or further theoretical improvements 
in the protocol would be required to make practical use 
of these resources. 

Single-mode squeezing as high as 12.7 dB has been 
achieved in optics experiments [32, 33], so it would 
be state of the art, but not unreasonable, to consider 
10 dB achievable in temporal-mode [30, 31] or frequency¬ 
mode [28, 29] CV cluster states. Using Eqs. (72), (73), 
and (74), this corresponds to an effective squeezing of 
+0.925 dB, or an effective s = 1.112. This would still al¬ 
low for semi-anonymous broadcasting—which we define 
as giving a probability p < 2/n of the sender being cor¬ 
rectly identified (less than twice the probability of ran¬ 
dom guessing). This would be possible when broadcast¬ 
ing 0.25 bits (corresponding to an SNR a = 0.414) for 
n < 11 or broadcasting 0.5 bits (a = 1) with n < 5. This 
would be enough for a proof-of-principle demonstration. 


C. Squeezing levels for GHZ-state protocol 

The calculations above assume that a full surface-code 
state is used as the resource. This has a macrocode- 
based graph with edge weights as shown in Fig. 6, 
which reduces the effective squeezing dramatically when 
projected down to an ordinary lattice [56]. A surface 
code is necessary for error mitigation but not for basic 
demonstration of the protocol itself. For this, a simple 
GHZ state will suffice. As shown in Fig. 4, this can be 
made from a linear CV cluster state. 

The basic graph G for the actual state created in the 
temporal-mode experiment [31] is shown in Fig. 7, where 
the full graph Z [ 8] is again obtained from G through 
Eq. (69). This graph has 2-node macrocodes (instead of 
4-node), and the edge weights are ±i (instead of ±|), 
which means that with a base squeezing of 5 dB, the 
effective s for a protocol based on this linear resource [56] 
is larger than in the surface-code case [compare Eq. (73)]: 

r ~ 0.5756 => s = -^\/sinh2r ~ 1.006. (75) 

v 2 

This corresponds to an effective initial squeezing of 
(effective #dB) = 201og 10 s — +0.05297 dB , (76) 
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FIG. 7: Basic graph G for the temporal-mode linear CV clus¬ 
ter state reported in [31]; the full graph Z [48] is obtained 
from this through Eq. (69). G, as shown, also represents 
frequency-mode CV cluster states reported in [29] up to triv¬ 
ial 7r phase shifts that merely flip the sign of some of the 
edges. Notice that G has the overall structure of a line graph 
[Fig. 4(a)], but the individual nodes of that lattice are now 
collections of 2 nodes called macrocodes. Each macronode is 
identified by its surrounding red oval. In the temporal-mode 
experiment [30, 31], each node within a macronode is a syn¬ 
chronous temporal mode in spatially separate laser beams. In 
the frequency-mode experiment [28, 29], each node is one of 
two polarizations with the same frequency. 


which can be compared with Eq. (74). 

With error correction not possible when using a GHZ 
state, we can reduce the wedge width w to its minimum 
value: w = 1. In this scenario, semi-anonymous broad¬ 
casting (p < 2/ra; see subsection above) is possible for 


c = 

0.25 bits 

(a 

= 0.414), 

n < 17; 

(77) 

c = 

0.5 bits 

(a 

= 1), 

n < 8; 

(78) 

c = 

0.75 bits 

(a 

= 1.828), 

n < 5; 

(79) 

c = 

1 bit 

(a 

= 3), 

n < 4. 

(80) 


Thus, optical technology available today [31] can be used 
to demonstrate a practical implementation of GHZ-state- 
based anonymous broadcasting using this protocol. 


D. Scalability 

The main advantage of these optical implementations 
remains in their immense scalability. CV GHZ states 
are already available today with current technology for 
anonymous broadcasting, and surface-code-based proto¬ 
cols are possible with state-of-the-art implementations. 
If the squeezing can be increased (or a more efficient 
conversion protocol devised), this technology holds great 
promise for large-scale anonymous broadcasting. 


VII. MATHEMATICAL RESULTS 


This sections provides mathematical results that are 
used in Sections III and IV. 


A. Gaussian distributions: notation and entropic 
properties 


We adopt the following notation for a random vari¬ 
able X with instantiations x £ R distributed according 
to a Gaussian (normal) distribution with mean ( X ) = /i 
and variance var(X) = ((A — /i) 2 ) = tr 2 : 


X-N^ix) 


i r o~m) 2 ~ 

VW XP [ 2a 2 


(81) 


This can easily be extended to a random column vec¬ 
tor X with instantiations x £ R ra distributed according 
to a multivariate Gaussian with mean (X) = fi and co- 
variance matrix cov(X) = ((X — n)(X — /x) T ) = £ > 0: 


1 

\/det(27rS’ 


exp 




(82) 


The entropy of the univariate Gaussian is 

H(X ) = (—log (X)) = i log(27reo- 2 ). (83) 


Note that we leave the base unspecified. Therefore, all 
entropies in this document are expressed in bits if the log 
based is 2, in nats if the log base is e, etc. Its multivariate 
generalization is 

H(X) = (-log IV S (X)) = ilogdet(27r e X). (84) 

For any random vector Y—not necessarily Gaussian— 
with mean /x and covariance X, its entropy is bounded 
from above by the entropy of a Gaussian-distributed ran¬ 
dom vector with the same covariance. In other words, 


H( Y) < * logdet(27reS) = H(X) . (85) 

These formulas are used in Section III and Section IV. 


B. Special cases of symmetric, tridiagonal, 
toeplitz/circulant matrices 


Consider the two n x n matrices 


/x 1 
1x1 
1x1 


T n (i) := 


lxl 
lxl 
1 x) 


( 86 ) 
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and 


C„(x) 


( X 1 

1 a; 1 

lxl 


lxl 

lxl 

\1 1 x) 


(87) 


with constant diagonal bands understood and missing en¬ 
tries taken to be 0. The notation is chosen because T„(x) 
is a Toeplitz matrix and C„(x) is its circulant counter¬ 
part. These matrices are uniquely defined for n > 3. We 
can complete the definition for all n £ N+ by also defining 

T 1 (x) = C 1 (x) := (x) , (88) 

T 2 (x) = C 2 (x) := (j ^ . (89) 

Now let us consider their determinants. 

Define t n (x) := detT n (x). Using the cofactor expan¬ 
sion of the determinant, we see that the following recur¬ 
rence relation holds for n > 3 [57, 58] : 

t n (x) = xf„_i(x) - 2 (x ). (90) 


where T n is the nth-order Chebyshev polynomial of the 
first kind, valid for n > 3. Note that c 2 (x) = f 2 (x) and 
Ci(x) = ti{x). Therefore, 


det Cy,, (x) — c n (x) 

= [u n ( f) if We {1,2}, 

\2(—1)" [T n (-§) - 1] if n > 3. 

(94) 


Now consider a perturbed version of the circulant ma¬ 
trix above: 


C n (x, a) 


/x + a 1 

1 x 1 
lxl 


!\ 


lxl 

lxl 

\ 1 lx/ 


(95) 


Cofactor evaluation of its determinant gives 


det C„(x, a) = det C ra (x) + adet T ra _x(x). (96) 


Since f 2 (x) = x 1 2 — 1 and U(x) = x by direct calculation, 
we see that this recurrence relation also holds for n = 2 
if we choose to{x) := 1. These are exactly the recurrence 
relation and initial conditions for the Chebyshev polyno¬ 
mials of the second kind U n (|). Therefore, 

det T„(x) = t n (x) = U n . (91) 


Specializing to n > 3 evaluates this to 


det C„(x, a) = 2(—1)” 
= 2(—l) n 



This result also agrees with the literature [59-62] after 
applying properties of Chebyshev polynomials. 

Define c n (x) := detC„(x). A cofactor expansion for 
n> 3 relates this to the result for the Toeplitz case: 


Cn(x) = xt n - i(x) - 2 [t n - 2 (x) + (-1)”]. (92) 


Plugging in Eq. (91) and using properties of Chebyshev 
polynomials gives 


c„(x) = 2(—1)" 



(93) 


Notice that this means 


det C„(x, a) 



det C„ (x), 


(98) 


which can be also be verified using Jacobi’s identity. Di¬ 
rect evaluation for n = 1 and n = 2 show that Eq. (98) 
is also valid for those cases and therefore valid for all 
n £ N+. Equations (91), (94), and (97) are used in Sec¬ 
tion IV. 


[1] “Global surveillance disclosures page on Wikipedia http: 
//en.Wikipedia.org/wiki/Global_surveillance_ 
disclosures. (2013"/,E2"/,807.93present) ; see the refer¬ 
ences therein for additional details,”, Wikipedia page, 
2014. 

[2] M. Movahedi, J. Saia, and M. Zamani, “Secure Anony¬ 
mous Broadcast,” arxiv:1405.5326vl [cs.DC] (2014). 


[3] F. Stajano and R. Anderson, “The Cocaine Auction Pro¬ 
tocol: On the Power of Anonymous Broadcast,” in Infor¬ 
mation Hiding (Springer Berlin Heidelberg, Berlin, Hei¬ 
delberg, 2000), pp. 434-447. 

[4] D. Chaum, “The dining cryptographers problem: Uncon¬ 
ditional sender and recipient untraceability,” J. Cryptol¬ 
ogy 1 (1988). 













16 


[5] A. Broadbent and A. Tapp, “Information-theoretic secu¬ 
rity without an honest majority,” in Proceedings of ASI- 
ACRYPT 2007, pp. 410-426 (2007). 

[6] A. Broadbent, S. Jeffrey, and A. Tapp, “Exact, Efficient 
and Information-Theoretically Secure Voting with an Ar¬ 
bitrary Number of Cheaters,” arXiv:1011.5242 [cs.CR] 
( 2010 ). 

[7] P. Boykin, Information security and quantum mechanics: 
security of quantum protocols, Ph.D. thesis, University of 
California, Los Angeles, 2002. 

[8] M. Christandl and S. Wehner, “Quantum Anonymous 
Transmissions,” in Proceedings of ASIACRYPT 2005, 
LNCS 3788 (Springer Berlin Heidelberg, Berlin, Heidel¬ 
berg, 2005), pp. 217-235. 

[9] G. Brassard, A. Broadbent, J. Fitzsimons, S. Gambs, 
and A. Tapp, “Anonymous quantum communication,” in 
Proceedings of ASIACRYPT, 2007, pp. 460-473 (2007). 

[10] X.-Q. Cai and H.-F. Niu, “Quantum Private Communi¬ 
cation with an Anonymous Sender,” Int. J. Theor. Phys. 
52, 411 (2013). 

[11] M. A. Nielsen and I. L. Chuang, Quantum Computation 
and Quantum Information (Cambridge, 2000). 

[12] T. F. Demarie, T. Linjordet, N. C. Menicucci, and G. K. 
Brennen, “Detecting topological entanglement entropy in 
a lattice of quantum harmonic oscillators,” New J. Phys. 
16, 085011 (2014). 

[13] J. K. Pachos, Introduction to Topological Quantum Com¬ 
putation (Cambridge University Press, 2012). 

[14] R. Barends et al, “Superconducting quantum circuits at 
the surface code threshold for fault tolerance,” Nature 
508, 500 (2014). 

[15] M. Suchara, J. Kubiatowicz, A. Faruque, F. Chong, C. 
Lai, and G. Paz-Silva, Proceedings of the 31st IEEE In¬ 
ternational Conference on Computer Design (2013), p. 
419. 

[16] A. Y. Kitaev, “Fault-tolerant quantum computation by 
anyons,” Annals of Physics 303, 2 (2003). 

[17] J. Pachos, Introduction to Topological Quantum 
Computation (Cambridge University Press, 2012). 

[18] A. Hamma, R. Ionicioiu, and P. Zanardi, “Bipartite en¬ 
tanglement and entropic boundary law in lattice spin sys¬ 
tems,” Phys. Rev. A 71, 022315 (2005). 

[19] S. S. Bullock and G. K. Brennen, “Qudit surface codes 
and gauge theory with finite cyclic groups,” J. Phys. A: 
Math. Theor. 40, 3481 (2007). 

[20] A. G. Fowler, A. C. Whiteside, and L. C. L. Hollenberg, 
“Towards practical classical processing for the surface 
code: Timing analysis,” Phys. Rev. A 86 , 042313 (2012). 

[21] H. Anwar, Towards Fault-Tolerant Quantum Compu¬ 
tation with Higher-Dimensional Systems, Ph.D. thesis, 
University College London, London, 2014. 

[22] G. Brennen, D. Song, and C. Williams, “Quantum- 
computer architecture using nonlocal interactions,” Phys. 
Rev. A 67, 050302 (2003). 

[23] J. Zhang, C. Xie, K. Peng, and P. van Loock, “Anyon 
statistics with continuous variables,” Phys. Rev. A 78, 
052121 (2008). 

[24] J. Zhang, “Local complementation rule for continuous- 
variable four-mode unweighted graph states,” Phys. Rev. 
A 78, 034301 (2008). 

[25] M. Gagen and G. Milburn, “Atomic tests of the Zeno 
effect,” Phys. Rev. A 47, 1467 (1993). 

[26] A. Beige and G. Hegerfeldt, “Projection postulate and 
atomic quantum Zeno effect,” Phys. Rev. A 53, 53 


(1996). 

[27] J. M. Dominy, G. A. Paz-Silva, A. T. Rezakhani, and D. 
Lidar, “Analysis of the quantum Zeno effect for quantum 
control and computation,” J. Phys. A: Math. Theor. 46, 
075306 (2013). 

[28] P. Wang, M. Chen, N. C. Menicucci, and O. Pfis- 
ter, “Weaving quantum optical frequency combs into 
continuous-variable hypercubic cluster states,” Phys. 
Rev. A 90, 032325 (2014). 

[29] M. Chen, N. C. Menicucci, and O. Pfister, “Experimental 
Realization of Multipartite Entanglement of 60 Modes of 
a Quantum Optical Frequency Comb,” Phys. Rev. Lett. 
112, 120505 (2014). 

[30] N. C. Menicucci, “Temporal-mode continuous-variable 
cluster states using linear optics,” Phys. Rev. A 83, 
062314 (2011). 

[31] S. Yokoyama et al., “Ultra-large-scale continuous-variable 
cluster states multiplexed in the time domain,” Nature 
Photonics 7, 982 (2013). 

[32] T. Eberle et al., “Quantum Enhancement of the Zero- 
Area Sagnac Interferometer Topology for Gravitational 
Wave Detection,” Phys. Rev. Lett. 104, 251102 (2010). 

[33] M. Mehmet, S. Ast, T. Eberle, S. Steinlechner, H. 
Vahlbruch, and R. Schnabel, “Squeezed light at 1550 nm 
with a quantum noise reduction of 12.3 dB,” Opt. Express 
19, 25763 (2011). 

[34] G. Paz-Silva, S. Rebic, J. Twamley, and T. Duty, “Per¬ 
fect Mirror Transport Protocol with Higher Dimensional 
Quantum Chains,” Phys. Rev. Lett. 102, 020503 (2009). 

[35] B. Yurke et al, “Observation of 4.2-K equilibrium-noise 
squeezing via a Josephson-parametric amplifier,” Physi¬ 
cal Review Letters 60, 764 (1988). 

[36] M. A. Castellanos-Beltran, K. D. Irwin, G. C. Hilton, 
L. R. Vale, and K. W. Lchnert, “Amplification and 
squeezing of quantum noise with a tunable Josephson 
metamaterial,” Nature Phys. 4, 929 (2008). 

[37] E. Flurin, N. Roch, F. Mallet, M. H. Devoret, and 
B. Huard, “Generating Entangled Microwave Radiation 
Over Two Transmission Lines,” Phys. Rev. Lett. 109, 
183901 (2012). 

[38] N. Bergeal, F. Schackert, L. Frunzio, and M. H. Devoret, 
“Two-Mode Correlation of Microwave Quantum Noise 
Generated by Parametric Down-Conversion,” Phys. Rev. 
Lett. 108, 123902 (2012). 

[39] C. Eichler et al., “Observation of Two-Mode Squeezing 
in the Microwave Frequency Domain,” Phys. Rev. Lett. 
107, 113601 (2011). 

[40] C. M. Wilson et al., “Observation of the dynamical 
Casimir effect in a superconducting circuit,” Nature 479, 
376 (2011). 

[41] M. H. Devoret, S. Girvin, and R. Schoelkopf, “Circuit- 
QED: How strong can the coupling between a Josephson 
junction atom and a transmission line resonator be?,” 
Annalen der Physik 16, 767 (2007). 

[42] S. Ashhab and F. Nori, “Qubit-oscillator systems in 
the ultrastrong-coupling regime and their potential for 
preparing nonclassical states,” Phys. Rev. A 81, 042311 
( 2010 ). 

[43] M. S. Allman et al, “Tunable Resonant and Nonresonant 
Interactions between a Phase Qubit and LC Resonator,” 
Phys. Rev. Lett. 112, 123601 (2014). 

[44] K. Moon and S. Girvin, “Theory of Microwave Paramet¬ 
ric Down-Conversion and Squeezing Using Circuit QED,” 
Phys. Rev. Lett. 95, 140504 (2005). 



17 


[45] A. Zagoskin, E. Il’ichev, M. McCutcheon, J. Young, and 
F. Nori, “Controlled Generation of Squeezed States of Mi¬ 
crowave Radiation in a Superconducting Resonant Cir¬ 
cuit,” Phys. Rev. Lett. 101, 253602 (2008). 

[46] W. Yi Huo and G. Lu Long, “Entanglement and squeez¬ 
ing in solid-state circuits,” New J. Phys. 10, 013026 
(2008). 

[47] P.-B. Li and F.-L. Li, “Engineering squeezed states of 
microwave radiation with circuit quantum electrodynam¬ 
ics,” Phys. Rev. A 83, 035807 (2011). 

[48] N. C. Menicucci, S. T. Flammia, and P. van Loock, 
“Graphical calculus for Gaussian pure states,” Phys. Rev. 
A 83, 042335 (2011). 

[49] S. Diehl, A. Micheli, A. Kantian, B. Kraus, H. P. Biichler, 
and P. Zoller, “Quantum states and phases in driven open 
quantum systems with cold atoms,” Nature Phys. 4, 878 
(2008). 

[50] T. M. Cover and J. A. Thomas, Elements of Information 
Theory (John Wiley & Sons, 2012). 

[51] E. T. Jaynes, Probability Theory, The Logic of Science 
(Cambridge University Press, 2003). 

[52] T. Stace, S. Barrett, and A. Doherty, “Thresholds for 
Topological Codes in the Presence of Loss,” Phys. Rev. 
Lett. 102, 200501 (2009). 

[53] G. Grimmett, Percolation (Springer Science & Business 
Media, 1999). 

[54] N. C. Menicucci, S. T. Flammia, and O. Pfister, “One- 
Way Quantum Computing in the Optical Frequency 
Comb,” Phys. Rev. Lett. 101, 130501 (2008). 

[55] S. T. Flammia, N. C. Menicucci, and O. Pfister, “The 
Optical Frequency Comb as a One-Way Quantum Com¬ 
puter,” J. Phys. B 42, 114009 (2009). 

[56] R. N. Alexander, S. C. Armstrong, R. Ukai, and N. C. 
Menicucci, “Noise analysis of single-mode Gaussian op¬ 
erations using continuous-variable cluster states,” Phys. 
Rev. A 90, 062324 (2014). 

[57] J. Borowska and L. Lacihska, “Recurrence form for deter¬ 
minant of a heptadiagonal symmetric Toeplitz matrix,” 


Journal of Applied Mathematics and ... (2014). 

[58] Z. Cinkir, “A fast elementary algorithm for computing 
the determinant of Toeplitz matrices,” Journal of Com¬ 
putational and Applied Mathematics 255, 353 (2014). 

[59] G. Y. Hu and R. F. O’Connell, “Analytical inversion of 
symmetric tridiagonal matrices,” J. Phys. A: Math. Gen. 
29, 1511 (1996). 

[60] M. Elouafi, “On a relationship between Chebyshev poly¬ 
nomials and Toeplitz determinants,” Applied Mathemat¬ 
ics and Computation 229, 27 (2014). 

[61] R. Alvarez-Nodarse, J. Petronilho, and N. R. Quintero, 
“Spectral properties of certain tridiagonal matrices,” Lin¬ 
ear Algebra and its Applications 436, 682 (2012). 

[62] C. M. Da Fonseca and J. Petronilho, “Explicit inverse of a 
tridiagonal k-Toeplitz matrix,” Numerische Mathematik 
100, 457 (2005). 

[63] We have assumed, without loss of generality, that the 

face and edge orientation at the edge eA of the inter¬ 
section of the arc V 2 (Alice) and the loop Vi satisfies 
(—1 y( e A)+°(eA) — otherwise, r acquires that sign. 

[64] If one can additionally squeeze the string mode f-z by a 
factor S 2 , then the protocol improves with the modified 
parameters t = 2 ^ s -2 an d « = 2 s 2 S 2 T 2 . 

[65] The variance restriction on the capacity is henceforth un¬ 
derstood. 

[66] Rather than engineering the always-on Hamiltonian Hint, 
one could instead simulate the interaction via repeated 
sequences of discrete evolution of the unitary U(t) = 
e -'Him 1 f or ghort times r ~ 1/S followed by complete 
decay of the ancillary modes. The unitary U (r) is a Gaus¬ 
sian operation and could be decomposed into a gate se¬ 
quence involving small connected networks of 5 modes, 
each consisting of single-mode squeezing, phase shifters, 
and beam splitters. The issue of engineering the interac¬ 
tion across boundaries of wedges would require ancillary 
modes that are shared between nearest-neighbor parties. 



